An NAT (network address translation) device performs translation on a source IP (Internet Protocol, Internet Protocol) address and a source port of a packet. With this technology, translation from a private network address/port to a public address/port may be realized, and translation between an IPv4 (Internet Protocol Version 4, Internet Protocol Version 4) packet and an IPv6 (Internet Protocol Version 6, Internet Protocol Version 6) packet may also be realized. For example, when the NAT realizes translation from IPv4 to Ipv6, NAT entries need to be established for different connections of different client PCs (Personal Computer, personal computer), so that different client PCs share one public IP address, and each connection uses a port number of a different public IP.
Currently, in order to solve a problem of shortage of IPv4 public network addresses, an operator can introduce and deploy NAT equipment in the operator's network. A server at an operator side needs to provide a network service for a large number of users, and therefore, a large number of connections need to be established between users and the server. Especially, some network applications adopt a technology such as Ajax, so that when a user requests for a network application adopting technologies such as an asynchronous JavaScript and eXtensible Markup Language (eXtensible Markup Language, XML) (Asynchronous JavaScript and XML, AJAX), dozens of, hundreds of, or even more TCP (Transmission Control Protocol, transmission control protocol) connections are generated. Because of the foregoing requirement, NAT equipment with high performance often can support dozens of mega of NAT entries, and can newly establish 1-2 M or even more NAT entries per second. In order to monitor a client correctly, the operator generally needs to generate one piece of log record information for every NAT entry, and each piece of log record information needs to occupy dozens of bytes. In this way, a data stream of log record information that needs to be generated by one piece of NAT equipment with high performance per second may be as high as dozens of or even hundreds of megabytes. In this way, a load that the NAT equipment generates log record information is heavy, and furthermore, a requirement on performance of a server that is used for storing the log record information and a requirement on a storage space are increased accordingly.